react
Safeguard articles tagged "react" — guides, analysis, and best practices for software supply chain and application security.
38 articles
React and TypeScript security best practices for 2026
A 2025 npm phishing attack hit packages with 2.6 billion weekly downloads. Here's how React and TypeScript teams reduce XSS, API, and dependency risk.
XSS defaults and escape hatches: React, Vue, and Angular compared
All three major frameworks escape output by default, but each ships a named escape hatch that turns raw HTML back on — and only one sanitizes it automatically.
Inside CVE-2025-55182: the React Server Components RCE and how to defend against it
A CVSS 10.0 pre-auth RCE in React Server Components, exploited within 48 hours of disclosure — how the deserialization flaw works and how to mitigate it.
Secure conditional rendering in React and Next.js Server Components
A CVSS 10.0 React Server Components flaw, patched in December 2025, shows why {isAdmin && <Panel/>} isn't access control — the data ships to the client either way.
eslint-plugin-react-refresh: What It Does and Why It Matters
A guide to eslint-plugin-react-refresh: what the only-export-components rule enforces, how it relates to the react-refresh webpack plugin, and its security relevance.
Is @vitejs/plugin-react Safe? A Security Review
@vitejs/plugin-react is a build-time dev dependency, so its security story is mostly about supply chain trust and keeping it current rather than runtime exploits.
React Diff Viewer: Is the npm Package Still Safe to Use?
The original react-diff-viewer has not shipped a release in years. Here is what that means for security and why most teams should move to the maintained fork.
mobx-react-lite: A Security and Dependency Guide
mobx-react-lite is the lightweight MobX binding for React function components. It is a small, focused dependency, and that shape has real implications for how you keep it safe.
Is react-hot-toast Safe to Use? A Security Review
react-hot-toast is a small, well-maintained React notification library with a clean security record, but the way you render toast content is where risk creeps in.
Is react-spinners Safe? A Supply Chain Look at the npm Package
react-spinners is a popular zero-dependency loading component library for React. Here is an honest look at what it is and how to keep small npm dependencies safe.
react-slick: Security and Maintenance Guide for 2025
react-slick is a hugely popular carousel component with no known CVEs, but slowing maintenance and its dependency chain are the risks worth watching before you adopt it.
react-md-editor: Using @uiw/react-md-editor Securely
How to use react-md-editor safely: what @uiw/react-md-editor does, the XSS risk in markdown preview, and why rehype-sanitize is not optional for untrusted input.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.